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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was 
established by the Homeland Security Act of 2002 {Public Law 107-296) by amendment 
to the Inspector General Act of 1978. This is one of a series of audit, inspection, and 
special reports prepared as part of our oversight responsibilities to promote economy, 
efficiency, and effectiveness within the department. 

The attached report presents the results of DHS' Office of Financial Management fiscal 
year 2008 Mission Action Plans audit. We contracted with the independent public 
accounting firm KPMG LLP (KPMG) to perform the audit. The contract required that 
KPMG perform its audit according to generally accepted government auditing standards. 
KPMG is responsible for the attached independent auditor's report and the conclusions 
expressed in it. 

The recommendations herein have been discussed in draft with those responsible for 
implementation. It is our hope that this report will result in more effective, efficient, and 
economical operations. We express our appreciation to all of those who contributed to 
the preparation of this report. 
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This report presents the results of our work conducted to address the performance audit objectives relative 
to the Department of Homeland Security's (DHS or the Department) Mission Action Plans (MAPs) 
developed to address the internal control deficiencies at the Office of Financial Management (OFM), 
These deficiencies were identified by management and/or reported in KPMG LLP (KPMG) Independent 
Auditors' Report included hi the Department's fiscal year 2007 Annual Financial Report (herein referred 
to as the "FY 2007 Independent Auditors' Report"). 

This performance audit is the third in a scries of four performance audits that the Department's Office of 
Inspector General (OIG) has engaged us to perform related to the Department's fiscal year 2008 MAPs 
for use in developing the Department's Interna! Controls Over Financial Reporting Playbook (ICOFR 
Play book). This performance audit was designed to meet the objectives identified in the Objectives, 
Scope, and Methodology section of this report. Our audit procedures were performed using draft MAPs 
provided to us on January 4, 2008. Interviews with DHS / OFM management and other testwork, was 
performed at various times through February 8, 2008, and our results reported herein are as of February 
22,2008. 

We conducted this performance audit in accordance with generally accepted government auditing 
standards (GAGAS). Those standards require that we plan and perform the audit to obtain sufficient, 
appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit 
objectives. We believe that the evidence obtained provides a reasonable basis for our findings based on 
our audit objectives. 

The performance audit did not constitute an audit of financial statements in accordance with GAGAS. 
KPMG was not engaged to, and did not, render an opinion on the Department's or OFM's internal 
controls over financial reporting or over financial management systems (for purposes of Office of 
Management and Budget Circular No. A- 127, Financial Management Systems, July 23, 1993, as revised). 
KPMG cautions that projecting the results of our evaluation to future periods is subject to the risks 
because of changes in conditions or because compliance with controls may deteriorate. 
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EXECUTIVE SUMMARY 



The Department of Homeland Security (DHS or the Department) has identified weaknesses in internal 
control over financial reporting through its annual assessment conducted pursuant to Office of 
Management and Budget (OMB) Circular No. A- 123, Management's Responsibility for Internal Control, 
and compliance with the Federal Managers ' Financial Integrity Act (FMFIA). Some deficiencies are 
material weaknesses identified by DHS' external financial statement auditor. Beginning in 2006, the 
Department launched a comprehensive corrective action plan to remediate known internal control 
deficiencies. The plan is documented in the Internal Controls Over Financial Reporting Playbook 
(ICOFR Playbook). The Mission Action Plan (MAP) is a key element of the ICOFR Playbook that 
documents the remediation actions planned for each control deficiency at the DHS component level. The 
MAP provides specific actions, timeframes, key milestones, assignment of responsibility, and the timing 
of corrective action validation. 

The objective of this performance audit was to evaluate and report on the status of the detailed MAP 
prepared by the Office of Financial Management (OFM) to correct internal control deficiencies over 
financial reporting. We conducted our audit in accordance with the standards applicable to such audits 
contained in the Government Auditing Standards, issued by the Comptroller General of the United States. 
Our audit was performed using specific criteria to assess the MAP development process used by OFM, 
and evaluate the MAPs submitted by OFM to the DHS Chief Financial Officer to be included in the 2008 
ICOFR Playbook. 

The evaluation criteria were developed from a variety of sources including technical guidance published 
by OMB, the Government Accountability Office, and applicable laws and regulations. We also 
considered DHS' policies and guidance, and input from the Office of Inspector General when designing 
evaluation criteria. Our evaluation criteria are: 

1. Identification (of the root cause) - Identification of the appropriate underlying root cause that is 
causing the internal control deficiency condition(s). 

2. Development (of the MAP) - Clear action steps that address the root cause, and attainable and 
measurable milestones at an appropriate level of detail. 

3. Accountability (for execution of the MAP) - The individual MAP owner is responsible for its 
successful implementation, ensuring that milestones are achieved and that the validation phase is 
completed. 

4. Verification and validation - The MAP includes written procedures to verify successful 
implementation of the MAP, a means to track progress throughout the MAP lifecycle, and 
reporting results when complete. 

While OFM prepared the MAP, most of the control deficiencies extend to the Department and its 
components, outside of OFM's direct authority or responsibility. Some of the underlying issues leading 
to these control deficiencies have existed since the Department's inception. Two significant control 
deficiencies caused DHS management to qualify the 2007 Secretary's Assurance Statement, and were 
reported as material weaknesses in the FY 2007 Independent Auditors' Report. The two control 
deficiencies were (1) parent/child reporting at the Office of Health Affairs (OHA), and (2) reconciliation 
of intragovernmental balances and transactions. 

We noted that the OFM MAP was written to broadly cover all control deficiencies and compliance with 
laws and regulations findings identified and reported in the FY 2007 Independent Auditors' Report, and 
did not provide specific details on individual control weaknesses. The root causes identified were not 
linked to specific control deficiencies, management financial statement assertions and did not fully 
describe the issue, e.g., why the control deficiency occurred, or the unique challenges that must be 
considered in development of an effective corrective action plan. 
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The MAP does not identify the unique issues affecting parent/child accounting and reporting for OHA 
transactions, or intragovernmental reconciliations and the corrective actions; and the MAP does not 
sufficiently address the depth of the issues. For example, the MAP does not include procedures that must 
be performed by the other Federal agency (who is the recipient of OHA funds), before OHA can properly 
report transactions and financial position, in compliance with generally accepted accounting principles. 
The MAP does not include procedures that will be performed to resolve material differences in trading 
partner balances in a timely manner, after they are identified. 

In addition, the MAP does not recognize several complicating factors, affects of a complex business 
environment, and various infrastructure issues, such as 

• Timely identification and commitment of resources to new accounting requirements, 

• Lack of sufficient financial management for new DHS programs and Directorates, or 

• Consideration of necessary financial data and requirements when negotiating interagency or 
intradepartment agreements, before the execution of the agreement; and 

• The interdependencies with other Departmental control deficiencies including deficiencies in 
other DHS components, or the degree of reliance and involvement needed from other Federal 
agencies. For example, one root cause cited in the MAP is the quality of data received from the 
components. 

We recommend that OFM complete documentation of the root cause analysis to identify the underlying 
causes of the material weakness, with an increased emphasis placed on the issues that contributed to 
qualifications in the Department's FY 2007 financial statements. Each significant control deficiency 
should have its own MAP. MAPs could be improved by: 

• Expanding the "Root Cause" section of the MAP to adequately describe the significant 
contributing conditions of the internal control deficiencies, and clearly link the issue, the reasons 
why the control deficiency occurred, and the unique challenges that must be considered in 
development of an effective corrective action plan; 

• Identifying critical interdependencies with other Departmental control deficiencies including 
deficiencies in other DHS components or other Federal agencies. Seek input from DHS 
components, and if necessary obtain input from other Federal agencies, to ensure full 
consideration of all interdependencies; and 

• Consider the broader issues affecting the control deficiencies, such as the need for policies and 
procedures to identify new financial accounting and reporting requirements; financial 
management infrastructure whenever new DHS offices, programs, or Directorates are created; the 
financial data and accounting requirements when negotiating interagency or intradepartmental 
agreements, before the execution of the agreement. 

Regarding the OHA financial accounting and reporting, and reconciliation of intragovernmental balances 
and transactions we recommend that OFM: 

• Include procedures that must be performed by, or in cooperation with, the other Federal agency. 
These procedures should include the valuation and presentation of assets, liabilities and net 
position of the funds maintained by the other Federal agency (the "child" agency), that are outside 
the control of DHS. 

• Include procedures that will be performed to resolve material differences in trading partner 
balances in a timely manner, after they are identified. 



3 



BACKGROUND 



The Department of Homeland Security (DHS or the Department) and the Office of the Chief Financial 
Officer (OCFO) recognize that deficiencies in internal control over financial reporting exist. The internal 
control deficiencies are reported by DHS management in its annual Secretary's Assurance Statements, 
issued pursuant to Office of Management and Budget (OMB) Circular No. A- 123, Management's 
Responsibility for Internal Control. The Secretary's Assurance Statement and the findings of the external 
auditor are reported in the Department's fiscal year 2007 Annual Financial Report (AFR). The conditions 
causing the control weaknesses are diverse and complex. Many conditions are systemic, inherited with 
legacy financial processes and information technology (IT) systems at the time of the Department's 
formation in 2003. The evolution of the Department's mission, programs, component restructuring, and 
other infrastructure changes has made remediation of these control weaknesses very challenging. To 
meet this challenge, the Department's Secretary, Chief Financial Officer, and financial management in the 
DHS components have adopted a comprehensive strategy to implement corrective actions beginning in 
fiscal year (FY) 2007 and continuing in FY 2008. 

The DHS OCFO, Internal Control Program Management Office (ICPMO) is primarily responsible for the 
development and implementation of the Department's strategy to implement corrective action plans. The 
ICPMO has documented its strategy and other related plans to remediate identified internal control 
deficiencies in the Internal Controls Over Financial Reporting Playbook (ICOFR Playbook). 

In 2006, the Department issued Management Directive 1030, Corrective Action Plans, and' the 
Department enhanced its existing guidance by issuing the Mission Action Plan Guide, Financial 
Management Focus Areas Fiscal Year 2008 (MAP Guide). In accordance with the MAP Guide, the 
Department and its components developed Mission Action Plans (MAP) that describe the corrective 
actions to be implemented. The Department continued to utilize Electronic Program Management Office 
(ePMO), a Web-based software application, to manage the collection and reporting of MAP information. 

The MAP Guide is applicable to all Department components, including , OCFO' s Office of Financial 
Management (OFM), and outlines the policies and procedures necessary to develop fiscal year 2008 
Department MAPs. All components were required to submit MAPs, or MAP updates, for any new or 
existing internal control deficiencies over financial reporting, identified by management or the external 
auditors, for input into to the fiscal year 2008 ICOFR Playbook. 

To comply with Management Directive 1030 and the MAP Guide, OFM prepared a detailed MAP for FY 
2008 to address the internal control deficiencies oyer financial reporting reported as material weaknesses 
in the 2007 Independent Auditor's Report. Within the material weakness, two control deficiencies lead to 
qualifications in the FY 2007 Independent Auditors' Report the Departmental level. These control 
deficiencies were; parent/child reporting at the Office of Health Affairs (OHA), and intragovernmental 
balances and reconciliations. These control deficiencies are described in the Findings section of our 
report. 

OBJECTIVE, SCOPE, AND METHODOLOGY 
Objectives 

The objective of this performance audit was to evaluate and report on the status of the detailed MAP 
prepared by OFM to correct internal control deficiencies over financial reporting. Our evaluation was 
performed using specific criteria, described in the Methodology section below, to assess the process used 
to develop and document OFM's FY 2008 MAPs. We did not evaluate the outcome of the MAP process, 
or any corrective actions taken by management during our audit, and our findings should not be used to 
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project ultimate results from MAP implementation. Recommendations are provided to help address 
findings identified during our performance audit. 

Scope 

The scope of this performance audit includes OFM's FY 2008 MAP developed to address certain 
financial reporting material weaknesses that exist throughput the Department at OFM as reported in the 
Secretary's FY 2007 Assurance Statement, and in the FY 2007 DHS Independent Auditors' Report. The 
MAP subjected to our performance audit was provided to us by the OCFO, on behalf of OFM, on January 
4, 2008. The scope of this performance audit did not include procedures on any of the MAPs associated 
with other control deficiencies existing at OFM as reported in the FY 2007 Independent Auditors' Report. 
Our audit was performed between the January 4, 2008 and February 6, 2008. We issued our report on 
February 29, 2008. 

Methodology 

We conducted this performance audit in accordance with the standards applicable to such audits contained 
in the Government Auditing Standards, issued by the Comptroller General of the United States. Our 
methodology consisted of the following four-phased approach: 

Phase I - Project Initiation and Planning — We attended meetings with the Department's Office of 
Inspector General (OIG), OCFO, and OFM to review the performance audit objectives and scope, 
describe our approach, communicate data requests, and gain an understanding of the status of OFM 2008 
MAPs. 

Phase II - Data Gathering - We performed interviews with accounting and finance management and 
staff at OFM and OCFO. Through these interviews, we gained an understanding of the process used to 
develop the MAP, including key inputs and data used, assumptions made, and reasons for conclusions 
reached. The interviews focused on the analysis performed by OFM to identify the underlying problems 
creating the internal control weakness (root cause), the planned corrective actions, the critical milestones 
chosen for measurement, and the methods used to monitor and validate progress in meeting the 
milestones. We discussed OFM's resource allocation strategy employed in the development and eventual 
implementation of the MAP, including the utilization of contractors to supplement staff as needed and the 
use of specialists, if necessary. We conducted meetings with the Department's OIG to identify and agree 
to the criteria used to evaluate the status of the MAP (as defined below). 

We performed reviews of key documents and supporting information provided to us. Our documentation 
reviews included: 

• The OFM MAP (i.e., the MAP Detail and Summary Reports) and any underlying supporting 
documentation provided by OFM. 

• The Notice of Findings and Recommendations (NFRs) issued during the FY 2007 financial 
statement audit by the external auditors that supported the internal control findings reported in the 
FY 2007 Independent Auditors' Report. 

• Information provided by OFM directors regarding the allocation of resources related to the MAPs, 
including the utilization of contractors. 

• The Annual Component Assurance statements provided pursuant to the requirements of OMB 
Circular No. A-123. 

• The ICOFR Playbook, MD 1030, the MAP Guide, and existing internal control monitoring 
guidance (e.g., OMB Circular No. A-123). 

Phase III - Analysis Using Established Criteria - Our evaluation criteria were developed from a variety 
of sources including technical guidance published by OMB (e.g., Circular No. A-123) and the 
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Government Accountability Office (e.g., Standards for Internal Control in the Federal Government), and 
applicable Federal laws and regulations (e.g., Federal Managers ' Financial Integrity Act of 1982). We 
also considered DHS' policies and guidance, such as the MAP Guide and the ICOFR Playbook, and input 
from the OIG. Our evaluation criteria were: 

1. Identification (of the root cause) - Identification of the appropriate underlying root cause that is 
causing the internal control deficiency. A comprehensive analysis typically includes a full 
assessment of the business processes, data flows, and information systems that drive the 
transactions/activities associated with the accounting process where the internal control deficiencies 
are believed to exist. A thorough root cause analysis should include: 

a) Research to discover why, when, and how the condition occurred - what went wrong and why? 

b) Investigation to determine if the problem is procedural or human resources or both (processes, 
and /or people). 

c) An evaluation to determine if IT system functionality is contributing to the problem, and if IT 
system modifications could be part of the remediation. 

d) An evaluation of internal controls, including the existence of compensating controls that may 
mitigate the deficiency. 

2. Development (of the MAP) - The MAP includes action steps that address the root cause, and 
attainable and measurable milestones at an appropriate level of granularity. Milestones should enable 
independent analysis of a MAP's effectiveness in remediating root causes, and provide MAP users 
with insight on the status of the MAP's implementation. For example, they should enable a user to 
determine if the appropriate level of resources to execute a milestone is available and identify 
potential gaps in milestones (e.g., a contractor may need to be hired before a specific milestone can be 
achieved). 

3. Accountability (for execution of the MAP) - Accountability for the MAP is clearly identified and 
assigned. The individual MAP owner is responsible for its successful implementation, ensuring that 
milestones are achieved, and validation of results. 

4. Verification and Validation - The MAP includes written procedures that verify successful 
implementation of the MAP, provide a means to track progress throughout the MAP lifecycle, and 
require reporting of results when complete. These activities should include documentation reviews, 
work observations, and performance testing that are maintained for internal OMB Circular No. A-123 
review and external audit. 

Phase IV- Findings and Recommendations - After conducting our Phase III procedures and applying the 
evaluation criteria to the MAPs, we formulated our findings and recommendations. The findings 
represent areas for potential improvement that could negatively affect OFM's remediation of the control 
deficiency if the MAP is executed as designed. 

FINDINGS AND RECOMMENDATIONS 

Our findings and recommendations presented below result from our audit of draft MAPs provided to us 
on January 4, 2008. We concluded our audit procedures on February 6, 2008. Management has 
represented that some findings and recommendations have been addressed by modifications made to the 
ICOFR Playbook after the end of our audit fieldwork. However, we did not audit modifications to the 
ICOFR Playbook made after the end of our audit fieldwork. Please see Management's Response for 
additional comments related to disposition of our findings and recommendations. 
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Findings 

OFM prepared and submitted a MAP to the OCFO in accordance the MAP Guide. The OFM MAP 
addresses the financial reporting process where internal control deficiencies existed within the 
Department and OCFO, at the end of fiscal year 2007. OFM prepared the MAP however, most of the 
control deficiencies extend to the Department and its components, outside of OFM's direct authority or 
responsibility. Some of the underlying issues leading to these control deficiencies have existed since the 
Department's inception. Correction of these deficiencies is difficult because they require substantial 
infrastructure and/or interaction with other Federal agencies. During our meetings, OFM management 
exhibited a clear understanding of the issues, and described corrective actions that were not always 
documented in the MAP. OFM has also implemented a MAP monitoring and validation process that 
includes periodic testing by an outside contractor. 

Two significant control deficiencies caused DHS management to qualify the 2007 Secretary's Assurance 
Statement, and were reported as material weaknesses in the FY 2007 Independent Auditors' Report. The 
two control deficiencies were: 

1 . Parent/Child Reporting at the Office of Health Affairs (OHA) - OHA was established during the 
Department's Post-Katrina reorganization in 2007. The OHA program office was created without the 
financial management infrastructure to support the program. The accounting and financial reporting 
requirements were not adequately defined and assigned in the early stages of the program's design 
and development. OHA was reliant on volunteered time from accountants in other components, often 
resulting in incomplete and untimely accounting for financial transactions. The most complex 
accounting and reporting requirements, e.g., accounting for parent/child transactions with another 
Federal agency pursuant to OMB Circular No. A-136, Financial Reporting Requirements, were not 
addressed for more than nine months, until OFM assumed the responsibility late in FY 2007. 
However, the complexity of the program and difficulties in obtaining data from the other federal 
agency prevented OFM from completing their work prior to September 30, 2007. Consequently, 
OHA was unable to provide sufficient evidential matter or make knowledgeable representations of 
facts and circumstances, that support transactions and account balances of OHA, as presented in the 
Department's September 30, 2007 balance sheet. These balances totaled more than $3 billion at 
September 30, 2007. 

2. Intragovernmental Balances and Reconciliations - DHS has not timely or completely reconciled 
intragovernmental balances with other Federal entities since the Department's inception. 
Consequently, DHS' Material Difference/Status of Disposition Certification Report, submitted 
quarterly to the U.S. Treasury frequently shows differences in excess of $1 billion. Some of the 
differences are identified as errors and unreconciled amounts. The differences are caused by a variety 
of circumstances existing in the DHS components and other Federal agencies. This condition 
affected DHS' ability to accurately report transactions with Federal government trading partners in 
the Department's financial statements at September 30, 2007, and previous years. 

Our findings related to the OFM MAP are: 

• A single OFM MAP is broadly written to cover all control deficiencies and non-compliance with laws 
and regulations findings reported in the FY 2007 Independent Auditors' Report. Individual control 
deficiencies, such as those described above, are not separately identified and addressed in the MAP. 
Consequently, the reader is not able determine the underlying issues, root causes, linkage to the 
financial statement assertions, or cross-reference to the specific corrective milestones for each control 
deficiency. 
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• The root causes identified were general, e.g., roles and responsibilities, policies and procedures, 
monitoring, quality of data, and staff resources. Specifically, the root cause analysis: 

a) Is not linked to specific control deficiencies, management financial statement assertions, and does 
not fully communicate a complete description of (1) the issue(s), (2) why the control deficiency 
occurred, and (3) the unique challenges that must be considered in development of an effective 
corrective action plan. 

b) Was often listed as a condition or symptom of the problem, e.g., "more complete, accurate and 
timely input data is needed" or "in FY 2007 one component submitted more than 40 
restatements." 

c) Does not clearly address the criteria defined in the Methodology section above and does not 
address the true underlying issues. For example, regarding item b) above, why was incomplete, 
inaccurate, and untimely input data submitted from the components, and why did a component 
need to submit 40 restatements? 

d) Is not supported by documentation of the analysis performed, e.g., research performed, personnel 
consulted, supervisory review, and independent corroboration of conclusions. 

• The MAP does not identify the unique issues affecting OHA parent/child accounting and reporting 
for OHA transactions, or intragovernmental reconciliations and the corrective actions; and the MAP 
does not sufficiently address the depth of the issues. For example the MAP does not: 

a) Include procedures that must be performed in cooperation with or by the other Federal agency 
(who is the recipient of OHA funds), before OHA can properly report transactions and financial 
position, in compliance with generally accepted accounting principles. 

b) Include procedures that will be performed to resolve material differences in trading partner 
balances in a timely manner, after they are identified. The MAP does not recognize the 
complicating factors that interfere with timely intergovernmental reconciliations, e.g., the 
adequacy of internal financial systems and accounting processes of some components, or 
reconciliations with trading partners that are unable to verify the reliability of their data. 

c) Adequately identify and address the effects of complex business environment and infrastructure 
issues, such as; 

- timely identification and commitment of resources to address new accounting 
requirements, e.g., OMB Circular No. A- 136, accounting and reporting for parent/child 
transactions in 2007 and beyond. Historically, changes in accounting principles and 
technical financial reporting requirements have not been identified early, and the proper 
accounting processes established before the changes become effective. 

- Lack of sufficient financial management and supporting financial infrastructure for new 
DHS programs and Directorates. DHS operations are restructured, or new programs, 
offices, Directorates are sometimes created, without necessary advance planning for 
financial management and infrastructure. 

- Consideration of necessary financial data and reporting requirements when negotiating 
interagency or intradepartmental agreements, before the execution of the agreement. 
Interagency agreements are sometimes entered into without adequate consideration of the 
accounting requirements and verification of data. 

• The MAP does not address interdependencies with other Departmental control deficiencies, 
including deficiencies in other DHS components, or the degree of reliance and involvement 
needed from other Federal agencies. For example, one root cause cited in the MAP is the quality 
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of data received from the components. OFM is reliant on data from components whose 
management is unable to provide assurances regarding the reliability if its data. Full remediation 
of departmental issues may be limited to advances made by components in correcting their 
material weaknesses. The MAP does not recognize that limitations exist in OFM's ability to 
assure the completeness and accuracy of the data received from the components. 

Recommendations 

We recommend that OFM: 

1. Complete documentation of OFM's comprehensive and thorough root cause analysis and maintain 
documentation to support that an analysis was performed to identify the underlying causes of the 
material weakness, with an increased emphasis placed on the issues that contributed to qualifications 
in the Department's FY 2007 financial statements. Each significant control deficiency should have its 
own MAP. 

2. Improve the MAPs by: 

a) Expanding the "Root Cause" section of the MAP to adequately describe the significant 
contributing conditions to the internal control deficiencies, and clearly link (1) the issue(s), (2) the 
reasons why the control deficiency occurred, and (3) the unique challenges that must be 
considered in development of an effective corrective action plan. Avoid listing symptoms as root 
causes. 

b) Identifying critical interdependencies with other Departmental control deficiencies including 
deficiencies in other DHS components, or other Federal agencies. Seek input from DHS 
components, and if necessary obtain input from other Federal agencies, to ensure full 
consideration of all interdependencies. 

c) Maintaining supporting documentation of the research performed, personnel consulted, 
supervisory review, and independent corroboration of conclusions. 

3. Regarding the OHA financial accounting and reporting and intragovernmental balances control 
deficiencies, identify the unique issues affecting parent/child accounting and reporting for OHA 
transactions, or intragovernmental reconciliations with trading partners, and document specific 
corrective actions for each control deficiency. The MAP should: 

a) Include procedures that must be performed by the other Federal agency. These procedures should 
include the valuation and presentation of assets, liabilities and net position of the funds 
maintained by the other Federal agency (the "child" agency), that are outside the control of DHS. 

b) Include procedures that will be performed to resolve material differences in trading partner 
balances in a timely manner, after they are identified. 

4. The MAPs should address the broader issues affecting the control deficiencies. Consider: 

a) Policies and procedures to identify new financial accounting and reporting requirements soon 
after the technical guidance is released, and then develop appropriate accounting processes in 
response. 

b) Necessary financial management infrastructure whenever new DHS offices, programs, or 
Directorates are created. 

c) The financial data and accounting requirements when negotiating interagency or intradepartment 
agreements, before the execution of the agreement. 
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MANAGEMENT RESPONSE 

Management has prepared an official response presented as a separate attachment to this report. 
In summary, management agreed with our findings and its comments were responsive to our 
recommendations. We did not audit management's response and, accordingly, we express no 
opinion on it. 
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KEY DOCUMENTS AND DEFINITIONS 



This section provides key definitions and documents for the purposes of this report. 

The Federal Managers ' Financial Integrity Act (FMFIA) requires that Executive Branch Federal agencies 
establish and maintain an effective internal control environment according to the standards prescribed by 
the Comptroller General and specified in the Government Accountability Office's (GAO) Standards for 
Internal Control in the Federal Government. In addition, it requires that the heads of agencies to 
annually evaluate and report on the effectiveness of the internal control and financial management 
systems. 

GAO's Standards for Internal Control in the Federal Government (Standards) defines internal control as 
an integral component of an organization's management that provides reasonable assurance of: 
effectiveness and efficiency of operations, reliability of financial reporting, and compliance with 
applicable laws and regulations. 

The Department of Homeland Security Financial Accountability Act (the DHS FAA) designates the 
Department's Chief Financial Officer (CFO), under the authority of the Secretary, as the party responsible 
for the design and implementation of Department-wide internal controls. Furthermore, the DHS FAA 
requires that a management's assertion and an audit opinion of the internal controls over financial 
reporting be included in the Department's annual Performance and Accountability Report. 

Office of Management and Budget (OMB) Circular No. A- 123, Management's Responsibility for 
Internal Control, provides guidance on internal controls and requires agencies and Federal managers to 
1) develop and implement management controls; 2) assess the adequacy of management controls; 3) 
identify needed improvements; 4) take corresponding corrective action; and 5) report annually on 
management controls. The successful implementation of these requirements facilitates compliance with 
both FMFIA and the DHS FAA. 

Office of Management and Budget (OMB) Circular No. A-127, Financial Management Systems, 
prescribes policies and standards for executive departments and agencies to follow in developing, 
operating, evaluating, and reporting on financial management systems. The successful implementation 
of these requirements facilitates compliance with both FMFIA and the DHS FAA. 

Internal Control Deficiencies - A control deficiency exists when the design or operation of a control 
does not allow management or employees, in the normal course of performing their assigned functions, 
to prevent or detect misstatements on a timely basis. A significant deficiency is a control deficiency, or 
combination of control deficiencies, that adversely affects DHS' ability to initiate, authorize, record, 
process, or report financial data reliably in accordance with U.S. generally accepted accounting 
principles such that there is more than a remote likelihood that a misstatement of DHS' financial 
statements that is more than inconsequential will not be prevented or detected by DHS' internal control 
over financial reporting. A material weakness is a significant deficiency, or combination of significant 
deficiencies, that results in more than a remote likelihood that a material misstatement of the financial 
statements will not be prevented or detected by DHS' internal control. 

Management Directive (MP) 1030, Corrective Action Plans, establishes the "Department's vision and 
direction on the roles and responsibilities for developing, maintaining, reporting, and monitoring MAPs 
specific to the DHS Financial Accountability Act, FMFIA, and related OMB guidance." In addition to the 
roles and responsibilities, MD 1030 outlines the policies and procedures related to the MAP process. The 
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organizational structure detailed in MD 1030 encompasses employees at both the component and 
department levels. 

The Internal Controls Over Financial Reporting (ICOFR) Playbook (ICOFR Playbook) was developed 
by the OCFO, Internal Control Program Management Office, to assist the Department in meeting the 
financial accountability requirements outlined in the DHS FAA. The ICOFR Playbook outlines the 
Department's "strategy and process to resolve material weaknesses and build management assurances." 
On an annual basis, the ICOFR Playbook is updated by the OCFO to enhance its exiting guidance, as 
necessary, and establish milestones, which will be monitored by the OCFO throughout the year. A 
component of the ICOFR Playbook is MAPs developed by the Department and its components to correct 
internal control deficiencies. 

The Mission Action Plan Guide, Financial Management Focus Areas Fiscal Year 2008 (MAP Guide) 
outlines the policies and procedures to be used to develop MAPs throughout DHS, pursuant to the roles 
and responsibilities established by the DHS Management Directive (MD) 1030, Corrective Action Plans. 
The MAP Guide applies to all Department Components and Offices (e.g., OFM) where a control 
deficiency has been identified. Note non-conformances related to the Federal Information Security 
Management Act (FISMA), are under the purview of the Department's Chief Information Security 
Officer 's Plan of Action and Milestones (POA&M) Process Guide. 

Electronic Program Management Office (ePMO) is a Web-based software application the OCFO 
deployed to manage the collection and reporting of MAP information. 

Mission Action Plans (MAPs), as defined in the MAP Guide, are documents prepared to facilitate the 
remediation of internal control deficiencies identified by management or by external parties. MAP 
documentation, as described in detail in the MAP Guide, includes a MAP Summary Report and a MAP 
Detailed Report that are required to be submitted to the OCFO through ePMO. Below are brief 
descriptions of the MAP Summary and MAP Detailed Reports, based on the ePMO MAP Reports Quick 
Guide contained in the MAP Guide: 

• The MAP Summary Report contains sections to describe the issue (e.g. internal control deficiency 
conditions), results of the root cause analysis performed, relevant financial statement assertions 
affected by the issue, key strategies and performance measures, resources required, an analysis of 
the risks and impediments as seen by management, verification and validation methods, and the 
critical milestones to be achieved. 

• The MAP Detailed Report provides additional data on the milestones, not only on those identified 
as critical but also those sub-milestones under a critical milestone. For each milestone (critical or 
sub), the following data is reflected: due date, percentage of completion, status (e.g., Not Started, 
Work in Progress and Completed), and the responsible and assigned parties. 

The Department's Annual Financial Report (DHS AFR) was issued on November 15, 2007 and consists 
of the Secretary's Message, Management's Discussion and Analysis, Financial Statements and Notes, an 
Independent Auditors' Report, Major Management Challenges, and other required information. The AFR 
was prepared pursuant to OMB Circular No. A- 1 36, Financial Reporting Requirements. 
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U.S. Department of Homeland Security 
Washington, DC 20528 




Homeland 
Security 



April 10, 2008 



MEMORANDUM FOR: 

FROM: 

SUBJECT: 



Richard L. Skinner, Inspector General 
David L. Norquist, Chief Financial O 



Draft Report: Independent Auditor 's Report on OFM's FY 2008 
Mission Action Plans 




Thank you for the opportunity to comment on the Draft Report: Independent Auditor 's Report 
on OFM's FY 2008 Mission Action Plans. We concur with the report's recommendations and 
we will ensure corrective actions are implemented to respond to the report's findings. For 
example, we have added additional milestones to address issues affecting parent/child accounting 
and reporting for DHS Office of Health Affairs and intragovernmental reconciliations. We look 
forward to continuing our partnership in implementing the DHS Financial Accountability Act. 
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